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Abstract — Modem single-photon detectors based on avalanche 
photodiodes offer increasingly higher triggering speeds, thus 
fostering their use in several fields, prominently in the recent 
area of Quantum Key Distribution. It is well known that after 
a detection event these detectors loose their single photons 
sensitivity for a period of time generically called dead time. If 
the acquisition system connected to the detector is not properly 
designed, and the triggering function not properly controlled, 
efficiency issues can arise when the triggering rate is faster than 
the inverse of detector's dead-time. Moreover, when this happens 
with two or more detectors used in coincidence, a security risk 
called "self-blinding" can jeopardize the distribution of a secret 
quantum key. 

In this paper we introduce a trigger-disabling circuitry based on 
an FPGA-driven feedback loop, so to avoid the above-mentioned 
inconveniences. In the regime of single-photon-attenuated light, 
the electronics dynamically accept a trigger only after detectors' 
complete recovery from dead-time. This technique proves useful 
to work with detectors at their maximum speed and to increase 
the security of a quantum key distribution setup. 

Index Terms — Single-photon detector, quantum key distribu- 
tion, quantum hacking, detector blinding, detector dead-time, 
high-speed detection, quantum efficiency. 

I. Introduction 

IN ORDER to detect a light signal attenuated at the 
single-photon level [1], the Single-Photon Avalanche Diode 
(SPAD) is of widespread use. SPADs have been employed to 
detect stars feeble light [2], to perform a sharp optical time- 
domain reflectometry [3] and in the vast majority of Quantum 
Key Distribution (QKD) realizations reported thus far [4], [5], 
[6], both in optical fibres and in free space. In particular, fibre- 
based QKD at the wavelength of 1550 nm, is an emerging 
technology which promises a high security level in telecom- 
munications while retaining quite a high transmission rate. In 
this wavelength range, the SPAD features quantum efficiencies 
up to 25% [7] and trigger rates of more than 1 GHz [8], [9], 
[10], [11], [12]. 

Let us briefly describe some particular aspects of the SPAD. 
First, in order to increase the detector's gain, the detector is 
operated in the so called "Geiger mode", where a reverse 
bias voltage higher than the detector's breakdown voltage 
is applied. If, despite the high gain, the dark count rate is 
low, the SPAD can be operated in "free running" mode; this 
usually happens at wavelengths close to the visible range, 
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e.g. 800 nm. If the dark count rate is high, as it happens 
in the infrared domain, e.g. at wavelengths of 1550 nm, 
then the SPAD is usually run in "gated mode", where the 
bias voltage is raised above the breakdown voltage only for 
a short period of time (the gate), when the photon to be 
detected is expected to arrive. This requires that the SPAD 
is well synchronized with the light source and the rest of 
the acquisition system. Another important point to consider 
is that the dark count rate can be increased by a non zero 
afterpulse probability: a detection event is given in the SPAD 
by an avalanche of electric charges, some of which can remain 
trapped in the junction and can be released in the following 
gates, thus giving rise to additional counts not corresponding to 
the arrival of new photons. To reduce the afterpulse probability, 
an afterpulse blocking electronics [13] is usually added to 
the SPAD with the aim of "freezing" it after the emission 
of an avalanche, for a time interval decided in advance by the 
operator. For example, one of the most popular single-photon 
detector in the third Telecom window, the id201 from IDQ [7], 
features an afterpulse probability going to nearly zero in about 
4 jis. [14]. This entails that, in order to minimize dark counts, 
a blocking time of at least 10 /zs should be applied to this 
detector. During the blocking time, the detector is not capable 
to detect single photons anymore. Hereafter, we generically 
define "dead time" any interval of time in which the SPAD 
looses its single-photon sensitivity. This can be due either 
to the natural response of the detector or to the afterpulse 
blocking circuit. Moreover, we focus on a SPAD run in gated 
mode, suitable for working in a high-noise regime, leaving the 
free-running mode analysis for a future work. 

In order to use a gated-mode SPAD, it is necessary to 
prepare an acquisition system capable of sending a trigger to 
it, read its output in a synchronized way and write the result 
into a memory location. However, during the preparation of 
such a system, we realized that a few problems arise when 
the triggering rate of the acquisition system is higher than the 
inverse of detector's dead-time. This situation is much more 
widespread than commonly believed. In fact, the acquisition 
system is usually much faster than the SPAD and its triggering 
rate coincides with the maximum rate allowed by the detector. 
For instance, the same id201 mentioned above, accepts a 
maximum trigger rate of 8 MHz, which is much higher than 
the 100 KHz corresponding to the inverse of the dead-time 
value given above, i.e. 10 /is. 
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One problem related to a SPAD running at its maximum 
trigger rate and with a non-zero dead-time, is the readout. 
If the acquisition system tries to read the SPAD during the 
dead-time period it only collects a sequence of futile counts 
which do not correspond to true detection events. The removal 
of these counts by a postprocessing algorithm is simple but 
very inefficient, time- and memory-consuming. A second, 
more important, problem is that when two or more SPADs 
are present in the same detection apparatus, one detector 
can be active while the other is blind. This happens, e.g., 
when one of the two detectors registers a photon and enters 
the dead-time period while the other does not register any 
photon and remains active. This situation can be exploited 
to control the detectors of the receiving unit, as described 
in [15]. Furthermore, in a wholly passive way, this flaw can 
be exploited to threaten the security of the QKD technology, 
by making the key distilled by the users not perfectly random 
and not entirely secret, as we shall show. 

We group these security breaches under the name of "self- 
blinding", because they are caused mainly by an improper use 
of the equipment by the legitimate users. 

In this paper we describe an acquisition system that allows 
for a proper triggering of single-photon detectors. We use an 
FPGA-based electronics to disable not only the trigger driving 
the SPAD gates but also the one driving the readout and the 
write up of the data to the memory. Hence useless data are 
no more registered by the acquisition system; the memory is 
better organized and the postprocessing procedures require a 
shorter time. Moreover the triggering technique can be easily 
extended to two or more detectors, so to avoid self-blinding. 

The paper is organized as follows. In Section II we describe 
our technique and apply it to a single SPAD. In Section III 
we consider the situation with a pair of SPADs and describe 
the security risks connected to self-blinding. In Section IV 
we apply our technique to a real setup and demonstrate its 
effectiveness. Section V is left for concluding remarks. 

II. Real-time disabling of the trigger 

The trigger-disabling acquisition system is schematically 
shown in Figure 1. The main element of the circuit is the 
clock buffer (CLK BUF) with clock enable CE input (bottom 
part of the figure). Its specifications are given in [17]. This 
buffer drives the clock output which in turn is connected 
to the detector's trigger input and memory clock input. In 
normal regime, the D flip-flop (FFD) is reset; the output is 
inverted and then fed into the clock buffer so the trigger 
clock is simply transferred from the input to the output and 
then to the detector. When a positive detection occurs, the 
rising edge of the SPAD's avalanche drives the change in the 
FFD output, thus disabhng the main clock and enabhng the 
COUNTER. The SPAD and the MEMORY will not see any 
trigger in this state. The FFD remains in this state until it 
is reset. The asynchronous reset occurs after a given number 
of main clock cycles, depending on the COUNTER and the 
binary comparator (COMP) level indicated as CMP VALUE in 
Fig. 1. All the circuitry is realized in an FPGA board (Xilinx 
SP605). 
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Fig. 1. Conceptual scheme of clock manager. FFD - D flip-flop latch, 
COUNTER - binary counter, COMP - binary comparator, CLK BUF - clock 
buffer, MEMORY - cache memory for storing detection results. For clarity 
the scheme does not include time correlations. To synchronize recording time 
and detection event additional elements are required. 



The trigger-disabling circuit has a main constraint i.e. the re- 
sponse time-interval Tresp that goes from the SPAD avalanche 
to the CLK BUF must be smaller than the inverse of the trigger 
rate uitrig- 

Tresp ^ • ( 1 ) 

^trig 

If this condition is not fulfilled, the trigger pulses continue 
to arrive at the detector until the clock buffer succeeds in 
disabling the trigger. This would result in maximal frequency 
limitation or in one or more futile zeroes registration by the 
QKD apparatus's cache memory. 

Several factors contribute to the total response time 
of the feedback loop: the detector response (28 ns for 
id200/id201 [7], which are the SPADs used in our setup), the 
length of cables (8 ns) and circuit inside FPGA (2 ns). This 
sets a maximum limit for the trigger-disabling technique with 
our current electronics at 26 MHz, which is much above the 
maximal trigger rate for id201. Shortening the total response 
time would increase the maximal frequency of the circuit. 
However, among the above delays, only the one caused by 
cables can be decreased easily without changing any other 
piece of hardware. 

In order to demonstrate the circuit working, we applied 
our electronics to a real setup, composed by a laser source 
(PicoQuant LDH-P-1550) triggered at 4 MHz, an optical 
attenuator, which fixes the average photon number at /x ~ 0.1, 
and a SPAD id201 set at 2.5 ns gate and 10% efficiency. 
In this configuration, we analyzed the percentage of cache 
memory occupied by useful triggers over a total duration of 12 
hours [18]. The results are plotted in Fig. 2. If trigger-disabhng 
is applied, the cache memory is occupied by useful data only, 
entailing that all the triggers sent to the SPAD have been 
effectively used for a meaningful acquisition. By consequence, 
the trigger-percentage per cache reaches the maximum, 100%. 
On the contrary, if the disabling technique is not apphed, the 
total amount of useful counts per cache varies according to 
the photon emission probability and detector dead-time. In 
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Fig. 2. Number of useful triggers per data sample. The lower solid curve 
shows percentage of useful triggers in cache in case of a standard triggering 
technique. It lays around a percentage value of 81%. When trigger-disabling 
technique is appUed all the triggers are useful, thus reaching a percentage 
of 100% (upper solid Une). The dotted line is a theoretical prediction when 
/u = 0.1 and ri = 0.1, providing a percentage of 83.4%. Nine hundred 
samples were taken in 12 hours [18]. 



particular, a lower percentage corresponds to a situation with 
more counts by the SPAD, i.e. to a higher intensity arriving at 
the detector. In fact, the more counts at the SPAD, the higher 
the number of futile zeroes present in the cache memory. Any 
futile zero must be removed from the cache which causes that 
the percentage of useful triggers remains significantly lower 
than 100%. There are two ways of removal, either by post- 
processing or by disabling the trigger before it arrives to the 
SPAD. In any case the post-processing consumes more time 
than a hardware solution [18]. 

Further performance analysis shows that the amount of 
removed triggers from cache depends on the product of the 
average photon number n and detector quantum efficiency ij. 
In fact, the probability of a positive detection per each light 
pulse is given by P = 1 — exp(— /xr^). Each time a pulse is 
detected, we have 1 useful trigger and M useless triggers, 
which fall inside the detector's dead time. These triggers have 
to be removed, either by post-processing or by disabling the 
trigger before it arrives to the SPAD. In any case, given N 
total triggers arriving at the measuring setup and k positive 
detections, the percentage of useful triggers is given by: 



^useful — 



N-kM 
N ■ 



(2) 



The average number of positive detection k is found through 
a numerical simulation. The result is directly substituted in 
Eq. (2) to find the average percentage Pusefui as function of /i 
and rj. The parameters of the simulation were the following: 
IJ, = 0.1, rj_= 0.1, M = 20, N = 8192, resulting in 
fc ~ 68 and Pusefui — 83.4. This last value has been used in 
Fig. 2 to plot the dotted curve corresponding to the theoretical 
model. The number of useful triggers per block of cache 
memory fluctuates in time. Short-term fluctuations are caused 
by detector's random behavior while long-term fluctuation 
are caused by an imperfect photon source whose intensity 
fluctuates. The trigger-disabling technique makes the amount 
of useful triggers per block of cache memory independent of 
these factors, as showed in Fig. 2, because only useful triggers 
are present in that case. 



III. Pairwise detection and self-blinding 

The technique described in the previous section can be 
fruitfully implemented when two or more SPADs are used at 
the same time, for instance in experiments where coincidence 
detection is important, or in QKD implementations, where 
each detector is assigned with a logical value of one bit, '0' or 
'1', and with a measurement basis, Z or X. The sequence of 
the bits will constitute, after a classical distillation procedure, 
the secret quantum key used for secure telecommunications. 

For the moment we consider a practical setup with only 
two detectors, which we call respectively Do and Di, assigned 
with the value '0' or '1' of the key bit. Such a description well 
adapts to what routinely happens in QKD implementations 
when, e.g., the BB84 protocol [4] is performed with an active 
choice of the basis (see e.g. [19] and [20]). In this case it is 
crucial for security that both detectors are active or inactive at 
the same time. If one detector is active and the other one is 
blind, e.g. during the dead-time following a positive detection 
event, then a security risk comes about [15]. 

In the standard scenario of QKD there are two main 
users, traditionally called Alice (the transmitter) and Bob (the 
receiver), who try to communicate privately over an insecure 
quantum channel, plus one eavesdropper, Eve, who aims to 
steal information from the channel. Eve can use any means 
allowed by the laws of physics to reach her goal. She can also 
exploit an imperfection of the setup to her own advantage. For 
example in [15] it is described how to exploit the detectors' 
dead-time to hack a particular QKD setup when the detectors 
are used in free-running mode. The same technique, which is 
a variant of the "faked-state attack" [21], can be adapted to 
hack also a setup based on gated-mode detectors, if a narrow 
temporal selection inside the gate is effected by the users to 
further clean their quantum signal [15]. This technique, though 
very powerful, requires an active intervention by Eve, who 
has to carefully design her light pulses and synchronize them 
with those transmitted by Alice to Bob. Furthermore, it is not 
effective against a QKD setup based on gated-mode detectors 
in which there is no temporal selection inside the gate. In 
that case, the eavesdropping described in [15] would cause an 
abnormal number of double counts, easily detectable by the 
legitimate users. 

In the following, we restrict our attention to such a kind 
of QKD setup, using gated-mode SPADs with no temporal 
filter inside the gate. We describe a totally passive action 
by Eve which is sufficient to create a security risk for the 
communication. Our aim is not to provide an attack which 
gives Eve 100% of the information sent by AUce; we only 
want to show that some extra bit could possibly be captured 
by Eve without the legitimate users being aware of that. 

Let us focus then on the typical situation of self-blinding: 
at Bob's side one detector is active while the other one is 
blind. This can happen in a QKD setup with a trigger rate 
higher than the inverse of detector's dead-time, which we 
define here as r^. After the whole quantum communication is 
completed, Bob announces on a pubhc channel the addresses 
corresponding to his non-vacuum counts; all the remaining 
addresses are associated to vacuum counts and are discarded 
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by the users. Eve will register all the counts announced by 
Bob, in particular those which correspond to qubits distant 
in time less than r^. All these bits will be necessarily anti- 
correlated. In fact, suppose that at a certain time t' detector 
£>o fires and Bob registers a '0'. If a second event occurs at 
time i!' with \t" — t'\ < r,i, it must come necessarily from Di, 
because Dq is in its dead-time period. So Bob will see a T. 
If another count occurs at time t'" with \t"' — t"\ < T4 it must 
necessarily be a '0', and so on. The net result will be that with 
a small, but non-zero, probability there will be in the final key 
groups of bits which are anti-correlated (e.g. 1010101...) rather 
than perfectly random. This is already a security breach in the 
theory of QKD. In fact, the two requisites for unconditional 
secure communication are (i) that the final key should be 
random and (ii) that it should be known only to the legitimate 
users [22]. So the first requisite here is violated. 

Now we want to show that also the second requisite of 
security can be violated by the passive strategy described 
above, i.e. some bits of the final key can be learned by Eve 
without Ahce and Bob being aware of that. In fact, after the 
addresses of the non-vacuum counts have been announced, 
the standard description of QKD [5] prescribes that Alice and 
Bob proceed with two classical procedures known as Error 
Correction (EC) [23] and Privacy Amplification (PA) [24]. 
EC aims at correcting potential errors (i.e. different bits) in 
the users' final keys. During this procedures a few bits are 
revealed on pubUc by the users to locaUze and finally correct 
the errors. Eventually the wrong bits and their positions will be 
known to Eve too. With PA, the users are supposed to reduce 
Eve's knowledge about these bits to nearly zero. However it 
can happen that some of these bits fall into a group which 
contains anti-correlated bits, e.g. 10101. In that case it is plain 
that Eve will inmiediately know all the members of the group 
as soon as she knows a single bit of the group. Hence the PA 
will erase Eve's knowledge about the single bit revealed, but 
not her knowledge about the remaining bits. 

The attack just described is entirely passive, as it is the result 
of a bad setup configuration by the users. For this reason we 
called it self-blinding. As already mentioned, self-bUnding can 
occur when detector's dead-time is higher than the inverse of 
the trigger rate: 

Td > . (3) 

^trigger 

The truer this inequality, the easier the self-bhnding mecha- 
nism. It is worth noting that the above self-bUnding condition, 
Eq. (3), is easy to fulfill, so it could represent a common 
mistake when using the SPADs. The reason is that one usually 
sets the electronics for a long dead-time, to reduce the after- 
pulses, and at the same time for a high trigger speed, to 
increase the final transmission rate. 

One solution against self-blinding is to slow down the 
triggering rate of the QKD apparatus, until Eq. (3) is no 
more satisfied, but this dramatically reduces the total efficiency 
of the system. Another possibility is to remove all the bits 
featuring a temporal distance less than by post-processing, 
but this can be very time-consuming. Also, one could resort 
to alternative descriptions of QKD [25], [26] in which the bits 
for EC are encrypted, so the positions of the errors will be 



not known to Eve at all. But this solves only the second flaw, 
not the first, i.e., the bits of the final key would still be not 
purely random. Our solution is based on hardware. We simply 
apply the trigger-disabling technique to guarantee that Bob's 
detectors are both active or both inactive at the same time. 

In the next Section we describe how this can be put into 
practice and present the experimental results obtained with this 
technique. 

IV. Experimental pairwise detection with 

TRIGGER-DISABLING 

In order to disable the triggering clock in case of a pairwise 
detector configuration we used a modified version of the circuit 
shown in Fig. 1. We connected both detectors outputs to the 
clock input port C of FFD through an OR gate, and fed 
their trigger input with the same signal coming from CLOCK 
OUTPUT. 

To show the effectiveness of the trigger-disabling technique 
we applied the electronics to a real setup composed by two 
SPADs, one id201, as before, and one id200. Both detectors 
are triggered at 4 MHz. We notice that the id201 detector 
is one of the receiving units in the "All- Vienna" QKD sys- 
tem [28], used in two recent quantum networks [29], [30]. 
According to what reported in Ref. [28], the system's average 
trigger rate was of 415 KHz. Hence Eq. (3) entails that self- 
blinding becomes important for that setup if a dead-time longer 
than 2.4 /is is used. On the other side, the id200 detector was 
used in the QKD system described in [20], and in the setup 
for the asynmietric feedback adopted in [31]. In Ref. [20] the 
trigger rate was 2.5 MHz and the dead-time 10 /is, so the self- 
blinding could have had an influence in that case. However, 
it should be noted that the QKD protocol used was not the 
BB84 but rather the LM05 [32], in which the two detectors 
are not directly associated to the logical bit value. Hence the 
above analysis is not directly applicable to this case. 

In the present paper's experiment we studied two figures of 
the apparatus, i.e., the frequency of coincidence counts and the 
randomness of the final key. In both cases we employed a light 
with intensity higher than the single -photon level, to simulate 
the detectors' response under the Eve attack described above. 
In the previous experiment the value of jj, was about 0.1. Now 
it is /i ~ 4. 

In order to see the frequency of coincidence counts, we 
collected more than 10^ events. We registered 13.5% of coin- 
cidences with trigger disabling ON and only 3.0% with trigger 
disabling OFF. This confirms that our technique reduces the 
probability of a self-blinding, because the two detectors are 
always operational together. Notice that the coincidence rate 
is not 100% even when trigger disabling is ON, because the 
light is not intense enough. A much more intense Ught would 
cause 100% coincidence counts if the trigger disabhng is ON, 
but could also damage the very sensitive SPAD. 

On a second step we monitored the randomness of the 
strings obtained from detectors when trigger disabling was 
either ON or OFF. Specifically we assigned a chck from 
detector Dq (Di) and no click from detector Di (Dq) with 
the value '0' ('!'), and collected all the values so to form 
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two Strings, one corresponding to ON and one to OFF. Two 
short sequences extracted from such strings are reported in 
Fig. 3; the empty (filled) circles correspond to the value '0' 

o»o»o»o»»o»ooo»o»o»o»o»o»»»oo»oo»o»o»o»o»o»o»o»o»o 
•o«oo«o«o«o«oo«o«o«o««o«oo«o«o«o«o«o«o«o«o«o«o«o«o 
•o«o«o«o««o«o«o«oo«o«ooo«o««o«o«o««oo«o«o«o«o«o«oo 
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•o»ooo»»oo»o»o»o»o»o»o»oo»o»oo»o»o«»o»o»»o»o»oo»o» 
oo»o»»o»o»»»o»o»oo»o»o»o»oo»«o»o«o»»ooo»o»ooo«o«o« 
o»o»o»o»o»o»o»o»o»o»»o»oo»o«o«o««o»oo»»o»oo»o«o«oo 
•o»o»o»o»o»o»o»o»o»o»o»o»oo»»oo»»o»o»o»o»o»o«o«oo« 
oo»»o»o»o»o»o»oo»»»ooo»»o»»o»o»o»o»ooo»»oo»»o»o»oo 
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Fig. 3. Sequences of events corresponding to detector Dq firing and Di not 
firing (empty circles) or Di firing and Dq not firing (filled circles). Top panel: 
a sequence of clearly non-random events, obtained when the trigger-disabling 
technique was OI'F. The alternate occurrence of empty and filled circles is 
apparent. Bottom panel: a sequence of events looking like random, obtained 
when the trigger-disabling technique is ON. The occurrence of relatively long 
sequences of empty and filled dots together with short sequences witoesses 
the random-like nature of the string. The events with both detectors firing have 
been removed for explicative purposes. For the measurement we employed a 
light with average photon-number ~ 4. 



(T). The difference is quite apparent. When trigger disabling 
is OFF (upper string), the sequence is clearly non random, 
since almost always a single is followed by a single 1, 
and viceversa. On the contrary, when trigger disabling is ON 
(lower sequence), the occurrence of a or a 1 is much 
less foreseeable. Also, the presence of relatively long sub- 
strings filled with all O's or I's, is an additional evidence of 
a random behavior. Note that while non-randomness can be 
easily demonstrated, for true randomness of finite sequences 
is not that easy since it does not exist a decisive test in 
this respect. Nevertheless we performed the DIEHARDER 
statistical tests [33] on our strings, most of which were passed 
by the ON string and none was passed by the OFF string. 

It could be argued that our choice ~ 4 is somewhat 
unusual in a QKD setup, where one has more often /i ^ 0.1. 
Our choice is motivated by the purpose of showing clearly in 
the experiment the effect of self -blinding. When n is smaller, 
the consequences of self-blinding are smaller too, but they 
do not disappear as there still remains a non zero probability 
to find blocks in the final key containing anti-correlated, non 
random, bits. 



V. Conclusion 

We introduced a FPGA-driven technique to run a single- 
photon avalanche diode at its maximum trigger rate, regardless 
of dead-time limitation. While in standard situations some care 
should be paid when the trigger rate is higher than the inverse 
of dead-time, with our technique this hindrance is removed by 
a trigger-disabling loop which stops the trigger to and from 
the SPAD until it has properly recovered from the dead-time 
period. The presented circuit can also serve as a simple dead- 
time generator for single-photon detectors which are produced 
without their own generator. 

Because of the absence of any futile counts, our technique is 
especially useful in case of implementation in embedded QKD 
systems as in this case one needs to record a huge amount 
of results in a limited local memory. Moreover the technique 
allows to remove completely the post-processing related to 
futile zeroes discarding, what results in shorter acquisition 
time. 

We provided an experimental evidence of our technique 
applied to a single SPAD, by reporting the trigger distribution 
in the acquisition system's cache memory. Additionally, we 
adapted the acquisition system to a pair of detectors used in 
coincidence and found an evident advantage of the trigger- 
disabling technique over a standard trigger usage in terms 
of distribution of the coincidence counts and in terms of 
randomness of the final string distilled from detectors' counts. 
Moreover, it removes at the roots the possibiUty of an external 
attack based on "self-blinding", because it forces the detectors 
in the receiving unit to be active or inactive altogether, at the 
same time. 

The proposed technique can be easily implemented in 
many different setup by just adding a piece of electronics in 
front of a standard SPAD, thus making the detector response 
time as short as possible. This paves the way to a future 
straightforward implementation of this technique in integrated 
commercial QKD apparatuses. 
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